GDPR and NIS2

Security and data protection checklist

The essentials for a small business. We check the ones visible from outside; you confirm the rest.

Site and server

To confirm

Encrypted connection and valid certificate

Everything visitors send (forms, contact details) travels encrypted.

GDPR, Article 32 — security of processing

To confirm

Software without known flaws

The site, theme and plugins are on versions with no public flaws.

GDPR, Article 32 · NIS2 — vulnerability management

To confirm

No signs of malicious code

No miners, strange redirects or hidden spam links.

GDPR, Article 32

To confirm

Privacy policy published

It says what data you collect, why, for how long and how to ask for deletion.

GDPR, Articles 13 and 14 — information to data subjects

To confirm

Cookie notice and choice

If you use non-essential cookies (analytics, advertising, embedded videos), ask for consent before turning them on.

ePrivacy rules and GDPR

Domain email

To confirm

Emails protected against spoofing

SPF and DMARC records stop anyone from sending fake invoices or payment requests in your name.

NIS2 — secure communications

Check yourself

Two-factor authentication on email

Your email account (and the recovery account) asks for a code as well as the password.

NIS2 — multi-factor authentication

Access and backups

Check yourself

Two-factor on hosting, domain and the site's admin panel

These are the accounts that, if stolen, let someone take over your site and email.

NIS2 — access control and multi-factor authentication

Check yourself

You know who has access to what

A simple list of who can access the site, email and customer data. Anyone who leaves loses access the same day.

GDPR, Article 32 · NIS2 — access control

Check yourself

Regular, tested backups

Automatic backups of the site and data, stored outside your hosting, and you have tried restoring one.

GDPR, Article 32 · NIS2 — business continuity

Personal data

Check yourself

A record of what you do with data

A sheet listing the data you handle (customers, invoicing, bookings), why, where it's stored and for how long.

GDPR, Article 30

Check yourself

Contracts with whoever processes data for you

Hosting, email, invoicing and online bookings: each has a data processing agreement (DPA).

GDPR, Article 28

When something goes wrong

Check yourself

You know what to do in an incident

Who to contact, how to take the site offline and how to recover. If personal data leaks, notify your data protection authority within 72 hours.

GDPR, Articles 33 and 34

Check yourself

Your team can spot phishing

A 15-minute talk about fake emails, links and urgent payment requests prevents most incidents.

NIS2 — cybersecurity training

Does NIS2 apply to my business?

NIS2 is an EU directive transposed into each country's law (in Portugal, Decree-Law 125/2025, in force since 3 April 2026). As a rule it applies to medium and large companies in sectors such as health, energy, transport, digital or food. Even when it doesn't apply, customers who are covered are starting to ask suppliers for these measures, and they are good practice for any business.

This list is a starting point and is not legal advice.